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(57) Abstract 

There is described a fraud detection 
system for use with a communications net- 
work, the network including a billing system 
comprising a database of customer account 
information and of account- associated call 
logging information including called num- 
bers, each customer account comprising cus- 
tomer name and address information and a 
settable indicator which when set indicates 
that the account is a debt account having a 
predetermined debt status the fraud detection 
system comprising first means responsive to 
a debt account for accessing, in use, the data- 
base for selecting a customer account, for 
obtaining a group of called numbers asso- 
ciated with the debt account and a group 
of called numbers associated with the se- 
lected customer account, for comparing the 
respectively obtained groups and, if the de- 
gree of similarity of the calling characteris- 
tics of the two customer accounts meets a 
predetermined criterion, providing an indi- 
cation that the selected customer account is 
a probable fraudulent-application account 
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Fraud preventing method for a communication network 

This invention relates to debt management in a 
communications network and particularly, but not 
exclusively, to the detection of customer accounts obtained 
by fraud. 

5 In a modern communications network such as the United 

Kingdom public switched telephone network (PSTN), the 
billing system is a sophisticated set of functions 
including Debt Management, which is a process to progress 
the collection of overdue payments including the issue of 
10 standard letters. Such a billing system is described in 
more detail in the article at pages 273 to 278 of British 
Telecommunications Engineering, Volume 11, Part 4, January 
1993. 

The concern of the present invention lies principally 

15 in combatting fraudulent applications for 
telecommunications services, which will usually be 
telephone service. 

According to a first aspect of the present invention 
there is provided a fraud detection system for use with a 

20 communications network, the network including a billing 
system comprising a database of customer account 
information and of account-associated call logging 
information including called numbers, each customer account 
comprising customer name and address information and a 

25 settable indicator which when set indicates that the 
account is a debt account having a predetermined debt 
status; the fraud detection system comprising first means 
responsive to a debt account for accessing, in use, the 
database for selecting a customer account, for obtaining a 

30 group of called numbers associated with the debt account 
and a group of called numbers associated with the selected 
customer account, for comparing the respectively obtained 
groups and, if the degree of similarity of the calling 
characteristics of the two customer accounts meets a 

35 predetermined criterion, providing an indication that the 
selected customer account is a probable fraudulent- 
application account. 
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Preferably, the first means, in use, selects customer 
accounts sequentially from the database and thereby 
performs such comparisons in respect of the debt account 
and each of the customer accounts in the database, in turn. 
5 A detection system of the first aspect may further 

comprise second means for accessing, in use, the database 
and for producing a list of debt accounts, and wherein the 
first means, in use, performs comparisons in respect of 
said selected customer account and each of the debt 

10 accounts in said list, in turn. 

According to a second aspect of the present invention 
there is provided a fraud detection system for use with a 
communications network, the network including a billing 
system comprising a database of customer account 

15 information and of account-associated call logging 
information including called numbers, each customer account 
comprising customer name and address information and a 
settable indicator which when set indicates that the 
account is a debt account having a predetermined debt 

20 status; the fraud detection system comprising first means 
for accessing, in use, the database and producing a list of 
debt accounts, second means responsive to a debt account of 
said list for accessing, in use, the database and obtaining 
a customer account whose address matches that of the debt 

25 account, such a customer account being referred to herein 
as a matched customer account, and third means for 
obtaining a group of called numbers associated with the 
debt account, for obtaining a group of called numbers 
associated with a selected customer account, for comparing 

30 the respectively obtained groups and, if the degree of 
similarity of the calling characteristics of the two 
customer accounts meets a predetermined criterion, 
providing an indication that the selected customer account 
is a probable fraudulent-application account. 

35 . Preferably the second means of this second aspect, in 

use, produces a list of matched customer accounts 
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corresponding to the list of debt accounts and the third 
means compares, in turn, the respective groups of called 
numbers associated with the matched customer accounts in 
the list with the respective groups of called numbers 
5 associated with the debt accounts corresponding to the 
matched customer accounts. 

A customer account may preferably be selected only if 
it is not a debt account. 

A fraud detection system in accordance with either of 

10 the two aspects of the present invention may comprise means 
responsive to receipt of an indication of a probable 
fraudulent-application account for generating for postal 
despatch a standard letter in accordance with the name and 
address information of the probable fraudulent-application 

15 account. 

In a fraud detection system as described above and for 
use when the customer accounts have a second settable 
indicator to indicate that the account is a probable 
fraudulent-application account, and a third settable 

20 indicator to indicate that the account is temporarily out 
of service, preferably the first means or the third means 
for providing an indication, as the case may be, as well as 
providing said indication also sets the second indicator of 
the probable fraudulent-application account, and there is 

25 included means responsive to receipt of said indication and 
to the expiry of a predetermined time interval therefrom to 
set the third indicator if at said expiry the second 
indicator is still set. 

The predetermined criterion may be that a called 

30 number having a predetermined number of occurrences in one 
of the compared groups of called numbers also has the same 
number of occurrences in the other compared group. 

Alternatively or additionally, the predetermined 
criterion may be,, or include the further requirement, that 

35 a set of different called numbers occurring in one of the 
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compared groups of called numbers also occurs in the other 
compared group. 

According to a third aspect of the present invention 
there is provided a user location system for use with a 
5 communications network, the network including a billing 
system comprising a database of customer account 
information and of account-associated call logging 
information including called numbers, each customer account 
comprising customer name and address information, the user 

10 location system comprising means responsive to a known 
account associated with a known user for accessing, in use, 
the database for selecting a customer account, for 
obtaining a group of called numbers associated with the 
known account and a group of called numbers associated with 

15 the selected customer account, for comparing the respective 
obtained groups and, if the degree of similarity of the 
calling characteristics of the two customer accounts meets 
a predetermined criterion, providing an indication that the 
known user is probably making calls at the address of said 

20 selected customer account. 

According to a fourth aspect of the present invention 
there is provided a method of detecting fraudulent use of 
a communications network, the network including a billing 
system comprising a database of customer account 

25 information and of account-associated call logging 
information including called numbers, each customer account 
comprising customer name and address information and a 
settable indicator which when set indicates that the 
account is a debt account having a predetermined debt 

30 status; the method comprising the steps of responding to a 
debt account to access the database, selecting a customer 
account, obtaining a group of called numbers associated 
with the debt account and a group of called numbers 
associated with the selected customer account, comparing 

3 5 the respectively obtained groups and, if the degree of 
similarity of the calling characteristics of the two 
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customer accounts meets a predetermined criterion, 
providing an indication that the selected customer account 
is a probable fraudulent-application account. 

According to a fifth aspect of the present invention 
5 there is provided a method of detecting fraudulent use of 
a communications network, the network including a billing 
system comprising a database of customer account 
information and of account-associated call logging 
information including called numbers, each customer account 

10 comprising customer name and address information and a 
settable indicator which when set indicates that the 
account is a debt account having a predetermined debt 
status; the method comprising the steps of accessing the 
database and producing a list of debt accounts, responding 

15 to a debt account of said list to access the database, 
obtaining a customer account whose address matches that of 
the debt account, such a customer account being referred to 
herein as a matched customer account, obtaining a group of 
called numbers associated with the debt account, obtaining 

20 a group of called numbers associated with the matched 
customer account, comparing the respectively obtained 
groups and, if the degree of similarity of the calling 
characteristics of the two customer accounts meets a 
predetermined criterion, providing an indication that the 

25 matched customer account is a probable fraudulent- 
application account. 

According to a sixth aspect of the present invention 
there is provided a method of locating a user of a 
communications network, the network including a billing 

30 system comprising . a database of customer account 
information and of account-associated call logging 
information including called numbers, each customer account 
comprising customer name and address information, the 
method comprising the steps of responding to a known 

35 account associated with a known user to access the database 
to select a customer account, obtaining a group of called 
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numbers associated with the known account and a group of 
called numbers associated with the selected customer 
account, comparing the respective obtained groups and, if 
the degree of similarity of the calling characteristics of 
5 the two customer accounts meets a predetermined criterion, 
providing an indication that the known user is probably 
making calls at the address of said selected customer 
account. 

Embodiments of the present invention will now be 
10 described by way of example with reference to the drawings 
in which: - 

Figure 1 is a block schematic diagram of a known 
customer services system for a communications network; 

Figure 2 is a block schematic diagram of a known 

15 billing system forming part of the customer services system 
of Figure 1; and 

Figure 3 is a block schematic diagram of a fraud 
detection system of the present invention associated with 
the billing system of Figure 2. 

20 As can be seen in Figure 1, a billing system is just 

one of a number of components of an overall customer 
services system (CSS) 10 forming part of the UK's public 
switched telephone network (PSTN). The CSS comprises over 
50 individual components covering a complete range of 

25 customer-facing activities. The most important of these 
components and their interrelationship is shown in Figure 
1, but for the purpose of the present invention, only the 
billing system 12 will be described further. 

A stored program controlled (SPC) exchange (not shown) 

30 forming part of the PSTN responds to a customer making a 
call to send to a call logging store 14 the details of the 
call, namely, the calling number, the called number, the 
date, the start time of the call and the finish time of the 
call. 

35 The billing system 12 processes this information to 

work out the duration of the call, the distance to the 
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called number, and the charge band appropriate to the time 
of day and produce a call charge. The charge details are 
then stored in a customer account store 16 against the 
calling number and when the customer' s telephone bill is 
5 prepared, the set of call details and charges stored 
against that calling number is retrieved to be printed and 
sent to the customer in accordance with the name and 
address entered in the customer account store against the 
calling number. 

10 Under a debt management component or sub-system 18 of 

the billing system 12, shown in Figure 2, a customer is 
sent a first reminder several weeks after the despatch of 
a statement of account. After several more weeks a second 
reminder is sent, and it could well be the end of the 

15 following accounting period before any positive action is 
taken by the network operator (accounts personnel) in 
respect of overdue payment. For further details of the 
billing system' 12 and the CSS 10, the reader may wish to 
refer to the above mentioned article in British 

20 Telecommunications Engineering. 

Under the known CSS 10 and billing system 12 as shown 
in Figures 1 and 2, the debt management sub-system 18 can 
be processing an overdue payment of a bill for a 
considerable number of weeks before a decision is taken by 

25 the network operator to recover the debt. In the meantime 
the customer could dishonestly apply for telephone service 
(declaring that he has no outstanding debt with the network 
operator). The dishonest customer might apply in a 
different name at the same address, and if he did so at the 

30 end of the accounting period for which the bill is 
outstanding then the amount of call charges on the new 
account the subject of a fraudulent application could be 
very large indeed by the time the fraud was detected. Such 
a fraud not only deprives the network operator of revenue 

35 but can also incur charges in the case of international 
calls made on the fraudulent-application account. 
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The dishonest customer who could be an individual or 
a company, may deliberately changes address to avoid 
detection as well as changing name. 

The present invention relates to determining that one 
5 customer is the same person as another customer on the 
basis of the similarity of their calling characteristics. 
This is principally of use to communications network 
operators so as to identify at an early stage if a new 
customer account has been obtained by fraudulent 
10 application and that it is therefore likely that the bill 
on that account will not be paid. 

A fraud detection system of the present invention can 
identify a probable fraud customer even though at a 
different address and using a different name from that of 
15 an existing debt account. The same principle could be used 
to locate a person for purposes other than fraud limitation 
on the basis of a known calling characteristic of that 
person. 

In one embodiment, (Figures 2 and 3) the debt 
20 management sub-system 18 of the billing system 12 sets a 
settable indicator, or flag, in the customer account 
automatically upon the expiry of twenty one days from the 
despatch of the customer's bill if payment has not been 
received by that time. The account is now referred to as 
25 a debt account and a process initiated for despatch of 
reminder letters of increasing severity. Thus, as used 
herein, the term "debt account" means an account which has 
a predetermined debt status indicated by its flag being 
set. 

30 When payment is received on a debt account, accounts 

personnel will normally reset the debt indicator. Further 
indicators are also used to indicate various stages of debt 
management as mentioned later. 

In Figure 3, a debt account file manager 20 accesses 

35 each of the accounts in the customer account store 16 in 
turn, and if an account has a set indicator, the manager 20 
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adds certain account details to a file (or list) called a 
debt account file 22. These details will be sufficient to 
identify the account and to enable the installation address 
to be matched with the installation address of a new 
5 customer account at the same address. For an individual 
person, the installation address will probably be the 
customer address, but this will not necessarily be the case 
for a company having several instruments which are not at 
the same physicaL address. 

10 The file manager 20 takes about 3 hours to access 

approximately 2 million customer accounts held in a 
regional billing system. Once the file manager 20 has been 
run initially and file 22 has been created it is only 
necessary to check a list of amendments made to the 

15 customer accounts to top-up the file. This topping-up is 
done daily. 

It will be appreciated that not only are new debt 
accounts added to the file 22 but also old debt accounts 
which have had their indicator reset will be deleted from 
20 the file. 

The file manager 20 accesses file 22 and in response 
to the debt accounts therein retrieves the itemised call 
details for the ultimate and penultimate bills from the 
call logging store 14 and writes these into an itemised 

25 call file 34. The daily topping-up performed by the file 
manager 20 keeps the itemised call file 34 up to date. 

The file manager 20 accesses the debt account file 22 
and obtains the installation address details of the first 
entry in the file. From these the file manager 20 accesses 

30 the customer account store 16 and looks for an account 
having the same installation address. Such an account is 
referred to herein as a possible fraudulent-application 
account (POSS, for . convenience ) . The file manager 20 
writes the corresponding address details into a matched 

35 address file 32. 



WO 94/23528 



- 10 - 



PCT/GB94/00599 



When the file manager 20 has checked all accounts in 
the customer account store 16, a debt account comparator 24 
now. accesses the matched account file 32 and for each POSS 
in turn accesses the itemised call file 34 for the debt 
5 account and the customer account store 16 for the POSS to 
retrieve the respective called number information from the 
itemised accounts for the last two accounting periods of 
the debt account, and for the last four weeks of the POSS. 
Ideally, the comparator will be operative daily so as to 

10 identify probable fraudulent application accounts (referred 
to herein as PROB, for convenience) as soon as possible. 
The comparator 24 checks to see if the calling 
characteristics of the POSS are the same as those of the 
debt account having the same installation address in 

15 accordance with a predetermined criterion. 

The comparator 24 provides an output signal 
(indication) 26 if both accounts have ten calls made 
(logged) to the same called number. If this requirement is 
not satisfied, the comparator 24 next checks whether there 

20 exists in each of the retrieved itemised accounts a set of 
the same five different called numbers, and provides the 
output signal 26 if this requirement is satisfied. The 
comparator also sets a settable indicator in the new 
customer account to indicate that this is a PROB. The 

25 output signal 26 is indicative that the new account is a 
PROB and is fed to an automatic letter generator 28 which 
responds by printing a letter for despatch by postal 
service to the customer of the PROB. Such a letter would 
make reference to the similarity of the PROB to the debt 

30 account and invite the customer to provide an explanation. 

A deadline circuit 30 is responsive to the date of 
issue of the letter despatched by the automatic letter 
generator 28. and checks to see whether a predetermined 
deadline, for example 21 days from this date of issue, has 

3 5 expired without the network operator having reset the 
indicator which indicates that the account was a PROB. In 
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this event, the deadline circuit 30 will be operative to 
set the first of a set of flags associated with the 
management of such an account. These flags indicate, inter 
alia, that a reply has been received, that a request for a 
5 deposit has been made, that a reply to that request has 
been received, and that the account is temporarily out of 
service (TOS). In the absence of receipt of a satisfactory 
explanation by a given date, the network operator could 
suspend service to the customer. 

10 In greater detail, the debt account file manager 20 is 

constituted by a suite of programs, and comprises a first 
program which identifies all debt accounts in the customer 
account store 16 by means of the associated indicator in 
the customer account record known as CUST-AC. For each 

15 debt account found an entry is made in the debt account 
file 22 comprising certain elements of the installation 
address to be used to match with a new customer at the same 
address. 

The suite also comprises a second program which uses 

20 the debt account file 22 to find those addresses in the 
customer account store 16 which have current service, and 
store them in a matched address file 32. The addresses of 
current and debt accounts are matched using certain 
elements of the address (e* g. postcode, thoroughfare ID, 

25 premises and sub-premises number). 

The suite also comprises a third program which creates 
a file 34 of all itemised calls on the last two bills of 
the debt accounts. This file will be used for comparison 
against the call logging information of the current 

30 customer at that address. 

The above three programs are associated with a fourth, 
" top-up" program which is run daily on the daily amendments 
made to the database and thereby makes corresponding 
amendments to the debt account file 22, the matched address 

35 file 32, and the itemised call file 34. 
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The suite also comprises a fifth program which checks 
all accounts stored in the matched address file 32 against 
the call logging store 14 to identify those current account 
holders at debt account addresses which have made calls in 
5 the last week; and a sixth program responsive to the output 
of the fifth program to get all calls made in the last four 
weeks by the identified current account holders. 

The debt account comparator 24 comprises a program 
which compares the output of the third and sixth programs 
10 to identify numbers called by the debt account and the 
current account at the same address, and also a program 
which identifies those customers who have a common call 
pattern (or characteristic) which is either ten or more 
calls to the same number, or calls made to five or more 
15 different numbers by the two customers. 

If desired, the fifth program need not be used, and 
the sixth program can operate for all current account 
holders in the matched address file 32. 

The abovementioned second, third, and sixth programs 
20 together with the debt account comparator 24 constitute a 
first means of the first aspect of the present invention, 
and the first program constitutes a second means of the 
first aspect of the present invention. 

The first program also constitutes a first means of 
25 the second aspect of the present invention. The second 
program constitutes a second means of this second aspect, 
and the third and sixth programs together with the debt 
account comparator 24 constitute the third means of this 
second aspect. 

30 In the embodiment of Figure 3, the debt account 

comparator 24 compares installation address details of the 
first entry in the file 22 with all the entries in the 
customer account store 16, except those already having a 
set debt account indicator, and then proceeds to repeat the 

35 process for the next entry in the file 22, and so on. In 
an alternative, not shown, the comparator 24 compares the 
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first entry of the customer account store 16 with all the 
entries in the file 22 and then repeats the process for the 
next entry in the customer account store 16, and so on. 

The embodiments described above are based on the 
5 concept of a fraudulent application for telephone services 
being made by the bad debt customer in a different name but 
at the same address. An alternative embodiment is based on 
the concept that a bad debt customer has moved to a new 
address and applies for telephone service in a different 
10 name. 

In this latter embodiment, a debt account file manager . 
20 creates a debt account file 22, and an itemised call 
file 34 as in the above embodiments, and a debt account 
comparator 24 checks the calling characteristics of a debt 

15 account with those of each of the customer accounts, except 
those already identified as debt accounts. 

As before, this embodiment checks all the customer 
accounts against the first debt account, and then against 
the second, and so on, and in an alternative embodiment, 

20 not shown, the first customer account is checked against 
each debt account, then the second customer account is so 
checked, and so on. 

It will be appreciated that the above mentioned 
comparison processes will ignore for characteristic 

25 matching purposes certain called numbers, for example, 123 
(speaking clock), for which there could be a legitimate 
reason why both accounts contain these called numbers. 

Whereas in the above described embodiments, the called 
number information for a debt account is retrieved from the 

30 customer account store 16 by the file manager 20 and stored 
in the itemised call file 34, it will be appreciated that 
the comparator 24 may be responsive to a debt account to 
retrieve such itemised call information directly from the 
customer account store 16. 

35 Furthermore, whereas the comparator 24 does two 

comparisons in sequence, it will be appreciated that the 
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10 



calling characteristics can be compared on the basis of the 
first comparison only, or of the second comparison only. 
Furthermore, a PROB could be indicated only if both 
comparisons give a positive result. 

The abovementioned UK PSTN comprises an interconnected 
network of SPC exchanges. This is not essential to the 
present invention which may be embodied in other forms of 
communications network, for example, a network based on 
passive optical network technology. 

The customer account details, for example, name, 
address, and various flags concerned with account 
management may be held in a store which is physically 
separate from that for holding the call logging details. 
Alternatively all the information may be in one large 
15 store. The particular arrangement of storing and accessing 
the information is not important, and the collective stores 
of such billing account information is referred to herein 
as a database of customer account information and of 
account-associated call logging information. Such as 
database may be a regional database, or one for the whole 
network, and may be centrally located in the region or 
national network, or distributed. 



20 
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CLAIMS 

1. A fraud detection system for use with a communications 
network, the network including a billing system comprising 
a database of customer account information and of account- 
5 associated call logging information including called 
numbers, each customer account comprising customer name and 
address information and a settable indicator which when set 
indicates that the account is a debt account having a 
predetermined debt status the fraud detection system 

10 comprising first means responsive to a debt account for 
accessing, in use, the database for selecting a customer 
account, for obtaining a group of called numbers associated 
with the debt account and a group of called numbers 
associated with the selected customer account, for 

15 comparing the respectively obtained groups and, if the 
degree of similarity of the calling characteristics of the 
two customer accounts meets a predetermined criterion, 
providing an indication that the selected customer account 
is a probable fraudulent-application account. 

20 2. A fraud detection system as claimed in Claim 1, where 
said first means, in use, selects customer accounts 
sequentially from the database and thereby performs such 
comparisons in respect of the debt account and each of the 
customer accounts in the database, in turn. 

25 3. A fraud detection system as claimed in Claim 1, 
further comprising second means for accessing, in use, the 
database and for producing a list of debt accounts, and 
wherein the first means, in use, performs comparisons in 
respect of said selected customer account and each of the 

30 debt accounts in said list, in turn. 

4. A fraud detection system for use with a communications 
network, the network including a billing system comprising 
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a database of customer account information and of account- 
associated call logging information including called 
numbers, each customer account comprising customer name and 
address information and a settable indicator which when set 
5 indicates that the account has a predetermined debt status, 
an account having its indicator set is referred to herein 
as a debt account; the fraud detection system comprising 
first means for accessing, in use, the database and 
producing a list of debt accounts, second means responsive 

10 to a debt account of said list for accessing, in use, the 
database and obtaining a customer account whose address 
matches that of the debt account, such a customer account 
being referred to herein as a matched customer account, and 
third means for obtaining a group of called numbers 

15 associated with the debt account, for obtaining a group of 
called numbers associated with the matched customer 
account, for comparing the respectively obtained groups 
and, if the degree of similarity of the calling 
characteristics of the two customer accounts meets a 

20 predetermined criterion, providing an indication that the 
matched customer account is a probable fraudulent- 
application account. 

5. A fraud detection system as claimed in Claim 4, 
wherein the second means, in use, produces a list of 

25 matched customer accounts corresponding to the list of debt 
accounts, and the third means compares, in turn, the 
respective groups of called numbers associated with the 
matched customer accounts in the list with the respective 
groups of called numbers associated with the debt accounts 

30 corresponding to the matched customer accounts. 

6. A fraud detection system as claimed in any one of the 
preceding claims, wherein a customer account is selected 
only if it is not a debt account. 
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7. A fraud detection system as claimed in any one of the 
preceding claims further comprising means responsive to an 
indication of a probable fraudulent-application account for 
generating for postal despatch a standard letter in 

5 accordance with the name and address information of the 
probable fraudulent-application account. 

8. A fraud detection system as claimed in any one of the 
preceding claims, for use when the customer accounts have 
a second settable indicator to indicate that the account is 

10 a probable fraudulent-application account, and a third 
settable indicator to indicate that the account is 
temporarily out of service, and wherein the first means or 
the third means for providing an indication, as the case 
may be, as well as providing said indication also sets the 

15 second indicator of the probable fraudulent-application 
account, and further including means responsive to receipt 
of said indication and to the expiry of a predetermined 
time interval therefrom to set the third indicator if at 
said expiry the second indicator is still set. 

20 9. A fraud detection system as claimed in any one of the 
preceding claims, wherein the predetermined criterion is 
that a called number having a predetermined number of 
occurrences in one of the compared groups of called numbers 
also has the same number of occurrences in the other 

25 compared group. 

10. A fraud detection system as claimed in any one of the 
preceding claims, wherein the predetermined criterion 
solely, or additionally, as the case may be, requires that 
a set of different called numbers occurring in one of the 
30 compared groups of called numbers also occurs in the other 
compared group. 



WO 94/23528 



PCT/GB94/00599 



- 18 - 

11. A user location system for use with a communications 
network, the network including a bill.ng system comprising 
a database of customer account information and of account- 
associated call logging information including called 

5 numbers, each customer account comprising customer name and 
address information, the user location system comprising 
means responsive to a known account associated with a known 
user for accessing/ in use, the database for selecting a 
customer account, for obtaining a group of called numbers 

10 associated with the known account and a group of called 
numbers associated with the selected customer account, for 
comparing the respective obtained groups and, if the degree 
of similarity of the calling characteristics of the two 
customer accounts meets a predetermined criterion, 

15 providing an indication that the known user is probably 
making calls at the address of said selected customer 
account. 

12. A method of detecting fraudulent use of a 
communications network, the network including a billing 

20 system comprising a database of customer account 
information and of account-associated call logging 
information including called numbers, each customer account 
comprising customer name and address information and a 
settable indicator which when set indicates that the 

25 account is a debt account having a predetermined debt 
status; the method comprising the steps of responding to a 
debt account to access the database, selecting a customer 
account, obtaining a group of called numbers associated 
with the debt account and a group of called numbers 

30 associated with the selected customer account, comparing 
the respectively obtained groups and, if the degree of 
similarity of the calling characteristics of the two 
customer accounts meets a predetermined criterion, 
providing an indication that the selected customer account 

35 is a probable fraudulent-application account. 
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13. A method as claimed in Claim 12, including selecting 
customer accounts sequentially from the database and 
performing such comparisons in respect of the debt account 
and each of the customer accounts in the database, in turn. 

5 14. A method as claimed in Claim 12, including accessing 
the database, producing a list of debt accounts, and 
performing comparisons in respect of said selected customer 
account and each of the debt accounts in said list, in 
turn. 

10 15. A method of detecting fraudulent use of a 
communications network, the network including a billing 
system comprising a database of customer account 
information and of account-associated call logging 
information including called numbers, each customer account 

15 comprising customer name and address information and a 
settable indicator which when set indicates that the 
account is a debt account having a predetermined debt 
status; the method comprising the steps of accessing the 
database and producing a list of debt accounts, responding 

20 to a debt account of said list to access the database, 
obtaining a customer account whose address matches that of 
the debt account, such a customer account being referred to 
herein as a matched customer account, obtaining a group of 
called numbers associated with the debt account, obtaining 

25 a group of called numbers associated with the matched 
customer account, comparing the respectively obtained 
groups and, if the degree of similarity of the calling 
characteristics of the two customer accounts meets a 
predetermined criterion, providing an indication that the 

30 matched customer account is a probable fraudulent- 
application account. 



16. A method as claimed in Claim 15, including producing 
a list of matched customer accounts corresponding to the 
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list of debt accounts, and comparing, in turn, the 
respective groups of called numbers associated with the 
matched customer accounts in the list with the respective 
groups of called numbers associated with the debt accounts 
5 corresponding to the matched customer accounts, 

17. A method as claimed in any one of Claims 12 to 16 
including selecting a customer account only if it is not a 
debt account. 

18. A method as claimed in any one of Claims 12 to 17, 
10 including responding to an indication of a probable 

fraudulent-application account to generate for postal 
despatch a standard letter in accordance with the name and 
address information of the probable fraudulent-application 
account. 

15 19. A method as claimed in any one of Claims 12 to 18, 
including providing respective second settable indicators 
to indicate that an account is a probable fraudulent- 
application account, and respective third settable 
indicators to indicate that an account is temporarily out 

20 of service, and further including, as well as providing 
said indication, also setting the second indicator of the 
probable fraudulent-application account, and responding to 
receipt of said indication and to the expiry of a 
predetermined time interval therefrom to set the third 

25 indicator if at said expiry the second indicator is still 
set. 

20. A method as claimed in any one of Claims 12 to 19, 
wherein the predetermined criterion is that a called number 
having a predetermined number of occurrences in one of the 
30 compared groups of called numbers also has the same number 
of occurrences in the other compared group. 
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21, A method as claimed in any one of Claims 12 to 20, 
wherein the predetermined criterion solely, or 
additionally, as the case may be, requires that a set of 
different called numbers occurring in one of the compared 

5 groups of called numbers also occurs in the other compared 
group. 

22. A method of locating a user of a communications 
network, the network including a billing system comprising 
a database of customer account information and of account - 

10 associated call logging information including called 
numbers, each customer account comprising customer name and 
address information, the method comprising the steps of 
responding to a known account associated with a known user 
to access the database to select a customer account, 

15 obtaining a group of called numbers associated with the 
known account and a group of called numbers associated with 
the selected customer account, comparing the respective 
obtained groups and, if the degree cf similarity of the 
calling characteristics of the two customer accounts meets 

20 a predetermined criterion, providing an indication that the 
known user is probably making calls at the address of said 
.selected customer account. 
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